Composer in CI

Before you start

• Create a token for the pipeline: an organisation token for a team's CI (it keeps working when people leave, Organisation tokens, billing, audit log and DPA), or a personal one (Composer tokens).
• Limit it to the packages the project uses and to your runners' IP ranges, and give it an expiry date.
• Save it as a secret in your CI, for example METEORGPL_TOKEN.
• The project's composer.json has the repository entry (Installing packages with Composer).

Hand the token to Composer

Composer reads credentials from the COMPOSER_AUTH environment variable, so nothing is written to disk:

COMPOSER_AUTH='{"http-basic":{"composer.meteorgpl.com":{"username":"token","password":"<your-token>"}}}'

GitHub Actions

- name: Install PHP dependencies
  env:
    COMPOSER_AUTH: '{"http-basic":{"composer.meteorgpl.com":{"username":"token","password":"${{ secrets.METEORGPL_TOKEN }}"}}}'
  run: composer install --no-interaction --prefer-dist

GitLab CI

install:
  image: composer:2
  variables:
    COMPOSER_AUTH: '{"http-basic":{"composer.meteorgpl.com":{"username":"token","password":"$METEORGPL_TOKEN"}}}'
  script:
    - composer install --no-interaction --prefer-dist

The CI page of the documentation has the same for Bitbucket Pipelines and CircleCI, and the step that reports composer.lock to a project.

Report what the pipeline installed

After composer install, a step can send composer.lock to a project, which then shows which packages are behind:

curl -fsS -u token:$METEORGPL_TOKEN -F lock_file=@composer.lock https://meteorgpl.com/api/projects/<project-id>/lock

The project page shows this command with its own id.

Caching

Versions never change once published: cache Composer's cache directory between runs, and commit composer.lock. Installs stay reproducible until a version is withdrawn.

Deploy on new versions

A webhook can start a pipeline when a package you use gets a new version, for example a GitHub repository_dispatch that runs composer update and opens a pull request.

Questions

My pipeline gets 403. The account or organisation has no active plan, or the runner's address is outside the networks the token allows. Check Settings → Composer tokens and the runner's outgoing IP address.